What we hold, what we don’t, and what never leaves your building.

What this page covers

This covers handistack.com and the work we do getting you to an installed system — the analysis call, the quote, the build agreement and support. It does not cover how your own firm handles client data on the system after it is installed. That is governed by your policies and your regulator, and we say so plainly below.

What this website collects

Only what you hand us:

• What you type into the contact form or the booking flow — your name, firm, email, phone, and whatever you write in the message field.
• Standard server logs: IP address, browser, pages requested, and when. Kept for security and troubleshooting.
• One functional cookie that remembers where you were in the booking flow. It carries no identifier and is not shared.

There are no advertising trackers, no third-party analytics pixels, no session recording and no fingerprinting scripts on this site.

What we do with it

We use what you send to answer you, prepare an analysis, write a quote and keep a record of what was agreed. That is the whole list. We do not sell it, rent it, trade it, or hand it to an advertising network. The only outside parties who touch it are the vendors that run our email and calendar, and they process it for us under contract — they may not use it for anything of their own.

Your systems: what never leaves

Once a system is installed in your building, inference is local. Prompts, documents, embeddings, model weights and outputs stay on the hardware you own. There is no outbound inference call, no telemetry carrying your content, and no setting that changes this. It is a property of the architecture, not a policy we could quietly revise.

We never train any model on your material, and we never use one firm’s files to improve another firm’s system.

What we can see during support

Maintenance needs some visibility, so here is exactly what it is:

• Health telemetry — temperatures, disk state, memory, GPU utilisation, service uptime, firmware versions. Machine facts, no content.
• Error traces, with content redacted before they reach us.
• Nothing else, unless you ask us into a session. Hands-on access requires you to grant it, per incident, and it is logged in your systems where you can read it back.

Audit logging runs to your log store, not ours. Retention is your policy to set.

How long we keep things

Enquiries that do not become projects are deleted after 24 months. Project records — the agreement, the build documentation, the control narrative — are kept while we support the system and for seven years after, because you may need them for an examination. Server logs roll off at 90 days. Ask us to delete something sooner and we will, unless a law requires us to keep it.

If you are a regulated firm

We will sign a Business Associate Agreement where HIPAA applies, and we will answer a GLBA or FFIEC vendor questionnaire without charging you for the privilege. Because installed systems process your data on your own hardware, our role is narrower than a cloud vendor’s — the control narrative we hand over at install says exactly where that line falls, in language you can put in front of an examiner.

Your choices

Ask us what we hold on you and we will tell you. Ask us to correct it, or delete it, and we will do that. There is no form and no ticket queue — call or write, and a person answers.

Changes to this page

If this changes materially we will date the change at the top and tell existing clients directly. We will not quietly widen it.

Asking us about any of this

Call (941) 269-4881 or write to hello@handistack.com. Privacy questions go to the same people who build the systems, because they are the ones who know the answer.

Written notice goes to Handistack INC, 8 The Green #21526, Dover, DE 19901 — a registered mailing address for legal correspondence, not a place of business.